@tiptap/extensions

Maintainerscaution

The package has four publishing accounts on the organization domain, with only _bdbch and svenadlung outside that domain; organization backing makes the core publishing setup reassuring, while those accounts are a minor hygiene caution.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script-injection counts, but all 19 action references are unpinned and the publish workflow has a high-confidence template-injection finding plus ad hoc package installation. These are CI hygiene concerns rather than evidence of an unfit release.